At over 1,000 data points, the pct operator automatically switches to the t-digest algorithm for approximate results. This approximation is more accurate near the extremes (e.g., 99th and 1st percentiles) and less accurate closer to the median.

The input to the operator is a percentile. For example:

pct(x, 50) gives the median (50th percentile and 0.5th quantile).

pct(x, 0.50) gives the 0.5th percentile, or 0.005th quantile (i.e., not the median).

Syntax

...| pct(<field> [, percentile]) [as <field>] [by <field>]

...| pct(<field> [, percentile, percentile, percentile]) [by <field>]

Rules

Creates a field named: _<fieldname>_pct_<percentile> {or [alias] if that's given}.

Separate multiple percentile arguments in one query with commas.

Multiple pct functions can be included in the same group-by aggregation.

Recommended articles

Sumo Logic is the industry’s leading secure, cloud-native, machine data analytics service, delivering real-time, continuous intelligence across the entire application lifecycle and stack. More than 1,000 customers around the globe rely on Sumo Logic for the analytics and insights to build, run and secure their modern applications and cloud infrastructures.